PT-2025-46557 · Apache · Apache Ofbiz

CVE-2025-59118 · Publicado 2025-11-11 · Atualizado 2025-12-23

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.03

Description A critical unrestricted file upload issue exists in Apache OFBiz. This allows remote attackers to upload arbitrary files, potentially including malicious scripts, leading to remote command execution (RCE) on the server. Successful exploitation could result in full system compromise, web shell deployment, or lateral movement within connected networks. Approximately 1.2k to 1.6k services are estimated to be affected worldwide. The issue involves the ability to upload dangerous file types without proper restrictions.

Recommendations Upgrade to version 24.09.03 to resolve the issue.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2025-59118

Produtos afetados

Apache Ofbiz

Referências · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59118.json · Exploit
• https://twitter.com/akaclandestine/status/1989257088808136756 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1988542993264251046 · Publicação no Twitter
• https://twitter.com/Komodosec/status/2002046909230546947 · Publicação no Twitter
• https://twitter.com/akaclandestine/status/1989761405462175994 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-59118 · Aviso do Fabricante
• https://twitter.com/fofabot/status/1988563286028386612 · Publicação no Twitter
• https://twitter.com/modat_magnify/status/1988607226391482659 · Publicação no Twitter
• https://twitter.com/HunterMapping/status/1988806566766637556 · Publicação no Twitter
• https://twitter.com/zoomeye_team/status/1988811636275310784 · Publicação no Twitter
• https://ofbiz.apache.org/download.html · Nota
• http://openwall.com/lists/oss-security/2025/11/11/1 · Nota
• https://twitter.com/Karma_X_Inc/status/1988476418842395058 · Publicação no Twitter
• https://ofbiz.apache.org/security.html · Correção, Aviso do Fabricante
• https://twitter.com/oss_security/status/1988365614247788825 · Publicação no Twitter